How to Auto-Start an Application on Windows Server Boot (NSSM + sc.exe)

Create the tools directory and download NSSM through PowerShell:

New-Item -ItemType Directory -Force -Path C:\Tools\nssm
Invoke-WebRequest -Uri "https://nssm.cc/release/nssm-2.24.zip" -OutFile C:\Tools\nssm.zip
Expand-Archive -Path C:\Tools\nssm.zip -DestinationPath C:\Tools\nssm-temp
Copy-Item C:\Tools\nssm-temp\nssm-2.24\win64\nssm.exe C:\Tools\nssm\
Remove-Item C:\Tools\nssm.zip, C:\Tools\nssm-temp -Recurse -Force

The nssm.exe file now lives at C:\Tools\nssm\nssm.exe. Always use the win64 build on modern servers.

Add NSSM to the system PATH so you can call nssm from any directory:

$old = [Environment]::GetEnvironmentVariable("Path", "Machine")
[Environment]::SetEnvironmentVariable("Path", "$old;C:\Tools\nssm", "Machine")

Close PowerShell and open it again to reload PATH. Confirm with nssm version — it should respond NSSM version 2.24.

Install the service pointing to the interpreter and the script. Replace the paths with the ones from your application:

nssm install MyApp "C:\Program Files\nodejs\node.exe" "C:\apps\myapp\server.js"

For Python applications:

nssm install MyApp "C:\Python312\python.exe" "C:\apps\myapp\app.py"

For Java applications:

nssm install MyApp "C:\Program Files\Java\jdk-21\bin\java.exe" "-jar C:\apps\myapp\app.jar"

The service name (MyApp) is what shows up in services.msc and in sc query. Use descriptive names without spaces.

Set the working directory of the application. Without this, any relative path in the code (logs, config files, modules) breaks, because the service starts in C:\Windows\System32 by default:

nssm set MyApp AppDirectory "C:\apps\myapp"

This is the most common misconfiguration on a first install. Remember: AppDirectory always points to the directory that contains the entry script.

Define environment variables that the application expects. NSSM accepts multiple variables separated by \0 (literal escape), or you can set one at a time:

nssm set MyApp AppEnvironmentExtra "NODE_ENV=production" "PORT=3000" "DATABASE_URL=postgres://..."

Sensitive variables (tokens, passwords) can live here, but keep in mind that the Windows registry is readable by any administrator. For real secrets, prefer reading from a .env file protected by ACL or from a dedicated vault.

Configure stdout and stderr logs — without these, any message the application prints simply vanishes:

New-Item -ItemType Directory -Force -Path C:\apps\myapp\logs
nssm set MyApp AppStdout "C:\apps\myapp\logs\stdout.log"
nssm set MyApp AppStderr "C:\apps\myapp\logs\stderr.log"
nssm set MyApp AppRotateFiles 1
nssm set MyApp AppRotateOnline 1
nssm set MyApp AppRotateBytes 10485760

AppRotateBytes 10485760 rotates the file once it reaches 10 MB. Without rotation, a forgotten log grows until it fills the disk.

Configure the crash restart policy. NSSM offers three modes: Restart (default — always restart), Ignore (do nothing), and Exit (do not restart). For production, keep the default but tune the delay:

nssm set MyApp AppExit Default Restart
nssm set MyApp AppRestartDelay 5000

A 5-second delay prevents a tight crash loop from eating CPU when the application is failing right at startup.

Mark the service as Automatic (starts on boot) and configure network dependencies:

sc config MyApp start= auto
sc config MyApp depend= Tcpip/Dnscache

The space after the = is mandatory — a quirk of sc.exe syntax. The dependency guarantees that the TCP/IP stack and the DNS Client are ready before the service starts — without this, applications that perform DNS lookups at startup randomly fail on boot.

Start the service now:

nssm start MyApp

You should see MyApp: START: The operation completed successfully.. If you get an error, jump to the verification section below before continuing.

Confirm that the service is running:

Get-Service MyApp

The Status column should show Running and StartType should be Automatic. If you see Stopped, open C:\apps\myapp\logs\stderr.log — the actual application error is there.

Test the application endpoint:

Invoke-WebRequest http://localhost:3000 -UseBasicParsing | Select-Object StatusCode, Content

Replace the port with the one you configured. A 200 OK response confirms that it is serving from session 0 correctly.

Reboot the server to validate auto-start for real. This is the only reliable way to make sure it will work tomorrow when you are not watching:

Restart-Computer -Force

Reconnect via RDP after about 60 seconds and run Get-Service MyApp again. Status Running without you touching anything = correct configuration.